Blur Exchange contest - cryptonue's results

Lines of code

https://github.com/code-423n4/2022-10-blur/blob/main/contracts/BlurExchange.sol#L540 https://github.com/code-423n4/2022-10-blur/blob/main/contracts/ExecutionDelegate.sol#L109 https://github.com/code-423n4/2022-10-blur/blob/main/contracts/matchingPolicies/StandardPolicyERC1155.sol#L33 https://github.com/code-423n4/2022-10-blur/blob/main/contracts/matchingPolicies/StandardPolicyERC1155.sol#L59

Vulnerability details

Impact

Order transaction of ERC1155 with intend to transfer x amount of token, will only send 1 token. This is a FATAL and HIGH severity issue as buyer will not get what they supposed to have.

Proof of Concept

File: execution.test.ts
099:     it('can transfer ERC1155', async () => {
100:       await mockERC1155.mint(alice.address, tokenId, 10);
101:       sell = generateOrder(alice, {
102:         side: Side.Sell,
103:         tokenId,
104:         amount: 5,
105:         collection: mockERC1155.address,
106:         matchingPolicy: matchingPolicies.standardPolicyERC1155.address,
107:       });
108:       buy = generateOrder(bob, {
109:         side: Side.Buy,
110:         tokenId,
111:         amount: 5,
112:         collection: mockERC1155.address,
113:         matchingPolicy: matchingPolicies.standardPolicyERC1155.address,
114:       });
115:       sellInput = await sell.pack();
116:       buyInput = await buy.pack();
117: 
118:       await waitForTx(exchange.execute(sellInput, buyInput));
119: 
120:       expect(await mockERC1155.balanceOf(bob.address, tokenId)).to.be.equal(5);
121:       await checkBalances(
122:         aliceBalance,
123:         aliceBalanceWeth.add(priceMinusFee),
124:         bobBalance,
125:         bobBalanceWeth.sub(price),
126:         feeRecipientBalance,
127:         feeRecipientBalanceWeth.add(fee),
128:       );
129:     });

the test script provide ERC1155 test with amount of 1, meanwhile the ERC1155 is designed to have x amount of tokenId y.

if we make the amount of order to be 5 in this example, this test will failed as the result would be 1, because inside the StandardPolicyERC1155.sol contract, the amount is ignored and hardcoded to be 1.

Tools Used

Hardhat test, VSCode

Recommended Mitigation Steps

Update StandardPolicyERC1155.sol return of amount to the makerAsk.amount, or makerBid.amount